The interpreter engine for the core JavaScript language, independent of the browser's object model. File ONLY core JavaScript language bugs in this category. For bugs involving browser objects such as "window" and "document", use the "DOM" component. For bugs involving calls between JavaScript and C++, use the "XPConnect" component.

Michael Daumling pointed this out in a private e-mail to brendan. I've checked in a fix for it on the trunk, but we should fix it on the branch too, since it's such a simple fix.
The code in question is:
ok = js_CheckPrincipalsAccess(cx, scopeobj, principals, js_eval_str);
if (!ok)
goto out;
ok = js_Execute(cx, scopeobj, script, caller, JSFRAME_EVAL, rval);
JS_DestroyScript(cx, script);
out:
I'll attach a patch for branch consideration in a second.

Created attachment 210375[details][diff][review]
Branch patch
This is the patch I checked in (backported to the paramaterization changes for js_CheckPrincipalsAccess). Brendan, mind stamping this for posterity?